Icon (ICLR) Risk Factors

Revenues from our government customers are derived from sales to federal, state and local governmental departments and agencies through various contracts. Sales to public segment customers are highly regulated. Noncompliance with contract provisions, government procurement regulations or other applicable laws or regulations (including but not limited to the False Claims Act) could result in civil, criminal and administrative liability, including substantial monetary fines or damages, termination of government contracts or other public segment customer contracts, and suspension, debarment or ineligibility from doing business with the government and other customers in the public segment. In addition, generally contracts in the public segment are terminable at any time for convenience of the contracting agency or upon default. The effect of any of these possible actions by any governmental department or agency could adversely affect our business, results of operations or cash flows. In addition, the adoption of new or modified procurement regulations and other requirements may increase our compliance costs and reduce our gross margins, which could have a negative effect on our business, results of operations or cash flows.

We act as authorized representative pursuant to Medical Devices Directive 93/42/EEC ("MDD"), Medical Devices Regulation 2017/745 ("MDR") and Active Implantable Medical Devices Directive 90/385/EEC ("AIMD") for certain clients who are located outside of the European Union. As authorized representative, we act on behalf of medical device manufacturers in relation to specified tasks with regard to their obligations under MDR. We also act as legal representative pursuant to European Clinical Trials Directive (2021/20/EC) ("CTD"), EU Clinical Trials Regulation (No.536/2014) ("CTR"), MDD, MDR and AIMD, for certain clients who are located outside of the European Union with respect to clinical trials being carried out by those clients in the European Union. We also perform similar legal representative services for certain clients in other non-EU jurisdictions, where the client is located outside the relevant local jurisdiction, ICON has an established local legal entity in that jurisdiction and analogous local regulations have a similar requirement for a local legal representative for clinical trials being carried out in those jurisdictions. As legal representative, we are responsible for ensuring compliance with the client's obligations pursuant to CTD, CTR and MDR or analogous local legislation and we are the addressee for all communications with the client provided for under CTD, CTR and MDR or analogous local legislation. We provide these services subject to certain terms and conditions which are contained in our agreements with clients pertaining to these services. We aim to reduce any potential liability associated with these activities by seeking contractual indemnification from our clients and by maintaining an appropriate level of insurance cover. However, there is no guarantee that the specific insurance will be available or that a client will fulfill its obligations in relation to their indemnity.

ICON has a strong privacy posture, driven by the implementation of a core privacy governance strategy and the adoption of policies and procedures designed to help ensure that ICON, including our employees and contractors, can comply with applicable data protection laws (including, but not limited to, the General Data Protection Regulation ("GDPR") (EU) 2016/679). Notwithstanding these measures, failure to comply with applicable data protection laws may occur and could result in increased risk of liability or increased costs to us or could limit our service offerings. Administrative fines. The GDPR introduced a new regime of administrative fines for data protection infringements and provided for a tiered penalty structure based on the nature of the infringement. The EU supervisory authorities for the GDPR can directly impose fines on organizations found to be in breach of the GDPR. Lower tier administrative fines allow for fines of up to 2% of worldwide turnover of the group in the preceding financial year. Higher tier administrative fines allow for fines of up to 4% of worldwide turnover of the group in the preceding financial year. Higher tier administrative fines are more likely to be levied for major infringements of the GDPR and core data protection principles (e.g. transparency, data retention, accountability). Penalties. The GDPR also permits Member States to implement rules on other penalties applicable to infringements of the GDPR, in particular, for infringements which are not subject to administrative fines under the GDPR itself. Therefore, Member States may legislate for further fines or penalties that may be criminal in nature. Any fines levied under the GDPR must be effective, proportionate, and dissuasive. Supervisory authorities have been strengthening enforcement activities across the EU in recent years in respect of breaches of GDPR. The risk of fines and penalties under the GDPR carries increased risk of liability to ICON and can result in increased costs and disruption to the delivery of our services. Right to compensation of data subjects. In addition to the risk of administrative and criminal penalties, the GDPR also provides that any person who has suffered material or non-material damage as a result of an infringement of the GDPR shall have the right to receive compensation for the damage suffered, from the controller or processor responsible for the infringement. The level of award of damages is set by the competent court in the applicable EU Member State. This carries increased risk of liability for ICON. Corrective Powers of the supervisory authorities. Each supervisory authority across the Member States of the EU also has corrective powers. Supervisory authorities have the power to order ICON to bring processing operations into compliance with the provisions of the GDPR in a specified manner within a specified time period, or to impose a temporary or definitive limitation including a ban on processing, and to order the suspension of data flows to a recipient in a third country or to an international organization. Supervisory authorities also have powers to conduct audits and investigations of ICON and instruct ICON to take certain actions. The exercise of these powers by supervisory authorities has the potential to increase costs for ICON and cause disruption to the business and delivery of our services. From a US perspective, the confidentiality, collection, use and disclosure of personal data, including clinical trial patient-specific information, is subject to governmental regulation generally in the country that the personal data was collected or used. For example, United States federal regulations under the Health Insurance Portability and Accountability Act of 1996, or ("HIPAA"), and as amended in 2014 by the Health Information Technology for Economic and Clinical Health ("HITECH") Act, require individuals' written authorization, in addition to any required informed consent, before Protected Health Information may be used for research. HIPAA specifies standards for de-identifications and for limited data sets. We are both directly and indirectly affected by the privacy provisions surrounding individual authorizations because many investigators and organizations with whom we are involved in clinical trials and in our other services are directly subject to them as a HIPAA "covered entity" and because we obtain identifiable health information from third parties that are subject to such regulations. As there are some instances where we are a HIPAA "business associate" of a "covered entity", we can also be directly liable to the covered entity contractually for mishandling protected health information and, under HIPAA's enforcement scheme, we can be subject to up to $1.9 million per year in civil money penalties for identical HIPAA violations. The per violation penalties and calendar year cap on penalties are adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act. The foundational principles of the GDPR have helped shape the development of many other privacy laws globally. Internationally, data protection laws continue to be introduced at a rapid rate, with greater protections afforded to personal data than ever before, and greater risk of liability to organizations processing that personal data. As a global organization, ICON must ensure that our privacy posture continues to adapt to these new laws and regulations. Additional legislation or regulation of this type might, among other things, require us to implement new security measures and processes which may require substantial expenditures or limit our ability to offer some of our services. Additionally, if we violate applicable laws, regulations or duties relating to the use, processing or security of personal data, we could be subject to civil liability or criminal prosecution, be forced to alter our business practices or suffer reputational harm.

The successful completion of clinical trials is dependent upon the ability to recruit suitable and willing patients on which to test the drug under study. The availability of suitable patients for enrollment in studies is dependent upon many factors including, amongst others, the size of the patient population, the design of the study protocol, eligibility criteria, the referral practices of physicians, the perceived risks and benefits of the drug under study and the availability of alternative medication, including medication undergoing separate clinical trials. Insufficient or inappropriate patient enrollment may result in the termination or delay of a study which could have a material adverse impact on our results of operations. The Company is focused on continuing to develop its expertise in patient recruitment with the establishment in 2020 of Accellacare, a global clinical research network, offering patients easier and faster access to innovative treatments and offering customers the option to deploy decentralized trials. The focus is on making it easier for the site and the patient to actively participate in a trial to ensure increased predictability, enrollment and retention. Our site and patient solutions group includes upfront planning of site and patient management including identification, enrollment and engagement. Improved site selection is achieved through: - leading technology to identify where the patients are that match the protocol;- assessment of the qualification of sites based on real data;- partnerships with leading technology vendors and developing the capability to enable Electronic Medical Record (EMR) interrogation into clinical insights such as sub-populations and larger pre-screened pools where the technology and regulations are enabled. The burden on the site, in ensuring patient enrollment and engagement, is achieved through integrated site networks. ICON has a number of site alliance partners. During 2018, we enhanced our site and patient recruitment capabilities with an expansion of the PMG Research network through a partnership with the DuPage Medical Group. During 2019, we further enhanced our site and patient recruitment abilities through the strategic acquisitions of MeDiNova and CRN. In 2020, ICON announced the launch of Accellacare, a global clinical research network offering patients easier and faster access to innovative treatments and offering customers the option to deploy decentralized trials. The site network includes previously acquired PMG Research, MeDiNova and CRN. Also in 2020, we entered into an agreement to jointly establish a new company, Oncacare Limited ("Oncacare"), with a third party. Oncacare operates as a specialized oncology site network in the US and EMEA regions. This site network is focused on implementing a range of commercial models with specialist oncology healthcare providers in the US and EMEA, to accelerate the recruitment and retention of patients into oncology trials. The oncology site network was operated as a joint venture between the Company and a third party until April 2023, at which point the Company acquired the third party's interest in Oncacare such that Oncacare became a wholly-owned subsidiary of the Company. We also use digital solutions to drive site performance, including pre-screening, eConsent, learning management, document tracking and management with key applications.

We depend on certain third parties to provide us with products and services critical to our business. Such services include, among others, suppliers of drugs for patients participating in trials, suppliers of kits for use in our laboratories, suppliers of reagents for use in our testing equipment and providers of maintenance services for our equipment. The failure of any of these third parties to adequately provide the required products or services, or to do so in compliance with applicable regulatory requirements, could have a material adverse effect on our business. Some of our services rely on intellectual property, technology and other similar property owned and/or controlled by third parties. Our licenses to this property and technology could terminate or expire and we might not be able to replace these licenses in a timely manner. Also, we might not be able to renew these licenses on similar terms and conditions. Failure to renew these licenses, or renewals of these licenses on less advantageous terms, could have a material adverse effect on our business, results of operations, financial condition or cash flow.

The performance of clinical development services is complex and time-consuming. We or vendors we engage may make mistakes in conducting a clinical trial that could negatively impact or damage the usefulness of the clinical trial or cause the results to be reported improperly. If the clinical trial results are compromised, we could be subject to significant costs or liability, which could have an adverse impact on our ability to perform our services. Large clinical trials are costly, and while we endeavor to contractually limit our exposure to such risks, improper performance of our services could have an adverse effect on our financial condition, damage our reputation and result in the cancellation of current contracts or failure to obtain new contracts from affected or other clients.

We provide services to biopharmaceutical, biotechnology, medical device and government organizations and our revenue is dependent on expenditures by these customers. Our business could therefore be adversely impacted by mergers, consolidation, business failures, distress in financial markets or other factors resulting in a decrease in the number of potential customers or therapeutic products being developed through the drug development progress. There has been consolidation in the biopharmaceutical market in recent years. If the number of our potential customers were to decline in the future, they may be able to negotiate price discounts or other terms for services that are less favorable to us than they have been historically.

Our business is dependent on our ability to generate new business awards from new and existing customers and maintain existing customer contracts. If we were unable to generate new business awards on a timely basis and contract for those awards, that could have a material impact on our business, financial condition, results of operations or cash flows.

We are exposed to the risk of employee fraud or other misconduct. Misconduct by employees could include intentional failures to comply with governmental regulations, comply with federal and state healthcare fraud and abuse laws and regulations, report financial information or data accurately or disclose unauthorized activities to us. In particular, sales, marketing and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, kickbacks, self-dealing and other abusive practices. These laws and regulations may restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs and other business arrangements. Employee misconduct could also involve the improper use of information obtained in the course of clinical studies or data or documentation fraud or manipulation, which could result in regulatory sanctions and serious harm to our reputation. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent misconduct may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws or regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business and results of operations, including the imposition of significant fines or other sanctions.

Our services are derived from, or include, the use of data we collect from third parties. We have several data suppliers that provide us with a broad and diverse scope of information that we collect, use in our business and sell. We generally enter into long-term contractual arrangements with many of our data suppliers. At the time we enter into a new data supply contract or renew an existing contract, suppliers may increase our cost to obtain and use the data provided by such supplier, increase restrictions on our ability to use or sell such data, or altogether refuse to license the data to us. Also, our data suppliers may fail to meet or adhere to our quality control standards or fail to deliver the data to us. Although no single supplier is material to our business, if suppliers that collectively provide a significant amount of the data we receive or use were to increase our costs to obtain or use such data, further restrict our access to or use of such data, fail to meet or adhere to our quality control standards, refuse to provide or fail to deliver data to us, our ability to provide data-dependent services to our clients may be adversely impacted, which could have a material adverse effect on our business, results of operations, financial condition or cash flow.

Numerous governments, including the U.S. government, have undertaken efforts to control growing healthcare costs through legislation, regulation and voluntary agreements with medical care providers and drug companies. If these efforts are successful, pharmaceutical, biotechnology and medical device companies may react by spending less on research and development and therefore this could have a material adverse effect on our business. In addition to healthcare reform proposals, the expansion of managed care organizations in the health care market may result in reduced spending on research and development. Managed care organizations' efforts to cut costs by limiting expenditures on pharmaceuticals and medical devices could result in pharmaceutical, biotechnology and medical device companies spending less on research and development. If this were to occur, we would have fewer business opportunities and our revenues could decrease, possibly materially.

A disease outbreak, such as influenza or coronavirus, could negatively impact our operations. We could experience restrictions on our ability to travel, or the ability of patients or other service providers to travel, to monitor our clinical trials and to ensure laboratory samples are collected and analyzed on time as a result of an outbreak. The potential impact of an epidemic or pandemic may also result in increased operating costs and result in a requirement to increase investment in impact prevention. COVID-19 has affected, and may continue to affect, our business performance and could adversely affect the economies and financial markets worldwide, resulting in an economic downturn that could impact our business, financial condition and results of operations.